password_verify() returns false for correct password

Hi Joey

The second parameter to the password_hash function is an algorithm which is of type integer so you cannot pass a string as the second parameter. PASSWORD_DEFAULT is a constant which holds the hashing algorithm and does not change. The function returns false when it fails to generate a hashed value.

Thank you for your reply Andreas. To further clarify, it is not password_hash() that returns false, but rather the password_verify().

Let's say I ran a page with this code:

<?php
$password = "Hello";
$hash = password_hash($password, PASSWORD_DEFAULT);

echo $hash;
?>

As you can deduce, it outputs the $hash value using the algorithm constant specified as default (PASSWORD_DEFAULT), along with its salt, in the form of:

$2y$10$NWY.NgZx7Zx/gG23dRcS9O.XO1YU/tRSmCY4G1EqQAwEmgbCFbL2m

for "Hello".

Obviously, on each reload the hash will be different (because of the salt), however, here's where things get a bit obscure for me:

If I copy the output value "$2y$10$NWY.NgZx7Zx/gG23dRcS9O.XO1YU/tRSmCY4G1EqQAwEmgbCFbL2m"

and submit it as an argument for

<?php
var_dump(password_verify("Hello", "$2y$10$NWY.NgZx7Zx/gG23dRcS9O.XO1YU/tRSmCY4G1EqQAwEmgbCFbL2m"));
?>

It outputs bool(false) instead of the expected bool(true) for some strange reason. You're welcome to try this, I only recently switched PHP version from 5.4 to 5.5, so perhaps it's just some server mishap.

In any case, however, if I do the following:

<?php

$password = "Hello";
$hash = password_hash($password, PASSWORD_DEFAULT);
echo $hash;

var_dump(password_verify("Hello", $hash));

?>

This returns bool(true) for var_dump(). The $hash is still echoed, but in this case, the same $hash variable is the second argument passed to password_verify().

My question is, why does it not work if I copy the outputted $hash generated from "Hello", as opposed to working just fine when using the $hash variable.

I assume that, logically, it can't be related to the instance (New hash generated when I copy the old one into password_verify() from the page load) since two users with the same password would inevitably run into issues.

I further went on to investigate with:

<?php
var_dump(password_get_info("$2y$10$NWY.NgZx7Zx/gG23dRcS9O.XO1YU/tRSmCY4G1EqQAwEmgbCFbL2m"))
?>

Which should return info about the generated hash, and yet it failed to recognize the algorithm, giving:

array(3) { ["algo"]=> int(0) ["algoName"]=> string(7) "unknown" ["options"]=> array(0) { } }

Cheers

Hi Joey

Sorry totally read your post incorrectly. Hugo's answer works.